Oliver Wyman is conducting a Risk Modelling Technology Benchmarking Survey to gather insights into risk modelling technology stacks, challenges, cost drivers, and migration plans within the banking sector across the UK and EU. The survey mainly consists of multiple-choice questions and is targeted at the risk modelling technology users (including regulatory change programs leaders, regulatory model owners and model developers). RiskBowl users are invited to participate – your input will help generate valuable benchmarking data, which will be shared exclusively with participants. We kindly request that the survey be completed by 21st November, with a view to share results by the end of November Access the survey here Should you have any questions, please feel free to reach out to Angelina Egorova, who is leading this initiative within our London F&R team. Thank you for your time and cooperation.

Conversations with our clients reveal the imperative of realizing the benefits from the promise of digitally transforming credit decisioning and lending journeys, driven by the need to control bank costs and retain customer loyalty in the face of competition from more nimble, digitally-native banks To better understand current trajectories in the lending transformation space, Oliver Wyman conducted a survey of banks across several markets, looking at the overarching burning platform, budgets, barriers to transformation, data, analytics, underlying technology, customer management, and organisational setup. In summary, our high-level, selected findings indicate Lending transformation is a high priority topic, with participants sequencing Retail and SME first in their lending transformation programs Respondents see the traditional incumbent breakthrough as the biggest competitive threat over the new fintech challenger looming on the horizon Decisioning time, revenue growth and cost reduction cited as top 3 benefits, whilst expected uplift is highest for customer experience Budget for lending allocation is approached on program level or on individual level, with very few respondents approaching it as a strategic objective Most budget is spent on customer journeys, internal workflows and underlying IT infrastructure rather than analytics capabilities [image: 1732202451766-lending-transformation-survey-infographic.png] Reach out for more insight, but we’d be keen to hear from the RiskbOWl community how this stacks up against your lending transformation program – post your thoughts below !

Risk Function of the Future As banking leaders look beyond 2025 toward 2030 and beyond, a series of “big debates” are emerging within the industry. How individual banks and banking sector as a whole resolve these debates will in large part shape the environment in which Risk functions operate, influencing priorities, resourcing, and governance structures over the coming decade. The Risk function of the future will need to be prepared for multiple, simultaneous pressures. First, it must respond to growing end-customer expectations for seamless experiences, while maintaining resilient performance, a combination that increasingly carries a high premium in competitive markets. Second, Risk functions must be ready for the next financial crisis, which many analysts view as increasingly “due” given historical cycles and macroeconomic pressures. Third, the function must confront actual climate-related risks, moving beyond scenario exercises to tangible, measurable mitigation and monitoring. Fourth, AI mastery will no longer be optional; it is rapidly becoming a table-stakes capability for Risk teams, both for efficiency and for insights-driven decision-making. While AI presents significant opportunities, Risk functions must approach it with both enthusiasm and realism. Many of the tasks performed by Risk involve “trust functions” i.e., oversight, challenge, and independent verification, which cannot be fully automated. Therefore, AI should be leveraged strategically, deployed where it adds measurable value, and integrated thoughtfully into existing control and assurance frameworks. Beyond technology, we also see a broadening of Risk’s remit. The Risk function is increasingly positioned to serve as the bank’s protector of truth, ensuring that information, assumptions, and metrics across the institution remain reliable, consistent, and auditable. In this sense, Risk is not just a defensive or compliance-oriented function; it is a guardian of credibility, playing a central role in how the bank navigates uncertainty, innovation, and stakeholder expectations over the next decade. Risk Vision and Strategy AI in Risk In the near term, Risk will enhance human productivity with GenAI as a supportive ‘co-pilot’, while waiting for more reliable technology before fully evolving into dynamic, specialized AI-human collaborative networks in 2030 In the next two to three years, leading Risk functions will deploy GenAI as a disciplined co‑pilot to amplify human productivity, prioritizing discovery and drafting tasks, supported by expert predictive scaffolding and anchored in high‑quality data repositories (including GRC/ RCSA tooling). Scope for holistic process reimagination however remains limited in scope until reliability materially improves, which we anticipate in the next decade and beyond As AI accuracy surpasses 99%, Risk will then transition into dynamic, specialized AI‑human collaborative networks, where orchestrated agents operate in real time under human supervision, unlocking scale, speed, and sharper decisioning across the enterprise Governance Future Risk Governance will strike a dynamic balance between 1/2LOD responsibilities, embrace (some) agile FinTech-inspired practices, deeply embed risk culture in the organization, and streamline governance Risk governance is migrating to a pragmatic equilibrium in the three lines of defence, with mature-risk activities moving closer to the first line for tighter business alignment while the second line rapidly builds expertise in novel risk types. At the same time, agile practices borrowed from FinTechs are reshaping ways of working, integrating risk early in decisions, preserving independence, and elevating a strong, lived risk culture across the enterprise To make this shift stick, successful Risk functions will simplify and rationalize committee structures, delegate more decision rights to where the information is richest, and advance the governance toolkit so oversight becomes faster, clearer, and more effective in a more volatile world Risk Pillars Credit risk The Credit Risk Function of the Future will reduce involvement in individual transaction approval and annual reviews, assessing risk based on real-time data In the near term, leading institutions will deploy AI to strengthen origination and monitoring, using targeted automation to boost coverage, consistency, and speed without compromising control or judgment Over time, these capabilities will converge into a fully integrated human-AI credit system that continually assesses risk using real‑time data and drives decisions through a “zero‑ops” approach—minimizing manual intervention while elevating oversight and outcome quality As accelerated digitalization and lending commoditization reshape the market, automated decisioning systems will expand in scope and ticket size, becoming a core engine of scalable growth and disciplined risk management Non-Financial Risk, Compliance and Economic crime The NFR function will revolutionize into a real-time and strategic response unit, integrating automation, AI and strategic accountability As non-financial risk capabilities modernize, previously manual processes will be seamlessly automated and orchestrated in real time, elevating regulatory adherence while shifting the function from reactive remediation to proactive risk management Continuous control testing, real-time compliance execution, and end-to-end accountability will hardwire strategic collaboration across the bank and direct control spend to the highest‑impact areas, creating a faster, clearer, and more anticipatory line of defence Model risk MRM is evolving into a proactive enabler of safe AI adoption, balancing innovation with oversight Model Risk Management is shifting from gatekeeper to catalyst, embedded in high‑impact initiatives to enable AI‑driven innovation, while moving earlier into the model lifecycle to strengthen oversight and collaboration with the first line. At the same time, supervisors are raising the bar on transparency and accountability for AI and third‑party models, pushing firms toward materially stronger governance frameworks that balance speed with safety Enablers Risk analytics, Modelling and Data Future Risk Analytics will leverage modularized toolkit powered by centralised data assets, and expand insights by harnessing unstructured big data for stronger predictive power Successful Risk functions will industrialize analytics by building centralized toolkits with standardized code modules that can be reused across multiple use cases, all powered by centralized data assets that act as a single “golden source” for the entire analytical suite Risk specialists will then harness GenAI to accelerate documentation, code generation, and peer reviews, shifting time from manual effort to deeper analysis and faster decisioning In parallel, the function will broaden its data universe by incorporating unstructured big data to materially strengthen predictive power, improving the accuracy, timeliness, and relevance of insights delivered to the business Talent The future Risk workforce will blend critical thinking, tech savvy, and risk intuition, while winning talent through diverse experiences, agile work styles, cutting-edge tech, strong culture, and inspiring leadership To build the risk function of the future, CROs must cultivate a more well‑rounded cadre of professionals, combining critical thinking, a big‑picture perspective, risk intuition, and strong technology literacy and analytics, while competing effectively in the war for talent by offering diverse experiences, more agile ways of working, advanced tooling, a strong, lived culture, and thoughtful leadership that inspires and retains new generations of risk experts In sum, the Risk function’s next chapter will be defined by its ability to simultaneously elevate customer experience, withstand systemic shocks, operationalize climate risk, and master AI, while preserving the integrity of core “trust functions” through disciplined oversight and human judgment. As governance evolves toward a pragmatic equilibrium across the lines of defence, with agile, FinTech‑inspired practices and a lived risk culture, Risk will increasingly act as the bank’s protector of truth, ensuring reliable, auditable decisioning in a more volatile world. Credit will transition toward integrated, real‑time, human‑AI systems that expand automated decisioning without sacrificing outcome quality; NFR and Compliance will become proactive, real‑time control engines; and Model Risk will shift from gatekeeper to catalyst, enabling safe, transparent AI at scale. Underpinning this transformation, centralized data assets, modular analytics, and GenAI‑accelerated workflows will industrialize insight generation, while unstructured data broadens the field of vision. Ultimately, success will hinge on talent i.e., blending critical thinking, risk intuition, and technology literacy, supported by inspiring leadership and agile ways of working. Those banks that commit early, invest thoughtfully, and embed these capabilities end‑to‑end will not only manage risk more effectively; they will compete and differentiate in the decade ahead

Since we wrote about geopolitical risk last year, we have seen industry practice evolve and we felt an update is warranted. Over the past six months, geopolitical risk has evolved from a peripheral factor to a structural dimension of enterprise risk management. Across client engagements in Europe, the US, and APAC, we observe a clear shift: leading banks are beginning to treat geopolitical uncertainty not just as a backdrop to macroeconomic scenarios or part of the Country Risk Teams, but as a direct risk driver. The change is being accelerated by supervisory focus—particularly in Europe. Institutions are expected to treat geopolitical developments as a material influence on their risk profile, both from a financial and non-financial perspective. The ECB has elevated this expectation as part of its core supervisory agenda for 2025–2027, which is already shaping risk steering discussions at board level. At a practical level, we see three main developments gaining traction: Geopolitical risk is becoming multi-dimensional. It's no longer confined to sovereign credit or country risk. The emerging practice is clear: geopolitical risk must be treated not as a siloed topic, but as a cross-cutting input into enterprise steering—from risk appetite to capital strategy, from third-party governance to digital infrastructure planning. Operational exposure is moving to the forefront. With increasing tension in global trade, the resilience of core operations—especially IT and critical vendor networks—is under renewed scrutiny. Cybersecurity, cloud sovereignty, and compliance with regional digital sovereignty laws (e.g. DORA) are now viewed through a geopolitical lens. Risk management approaches are becoming more forward-thinking. Rather than waiting for events to materialize, banks are building structured response capabilities based on scenario analysis, cross-functional simulations, and targeted early-warning frameworks. In conversations with risk and strategy executives across global banks, a common theme is emerging: the need to move from fragmented, reactive risk tracking to a coherent and mature, cross-functional framework that embeds geopolitical thinking into core risk processes. [image: 1753805641026-d0f2aaf0-a352-4ff7-9158-5d46bf252bce-image.png] Figure 1: Oliver Wyman Geopolitical Risk Management Framework While practices vary widely, two elements are consistently present among institutions leading the field, which we describe below: top-down portfolio scans for geopolitical sensitivity, and crisis simulation. Top-Down Portfolio Scans for Geopolitical Sensitivity Before banks can simulate or plan for geopolitical disruption, they need clarity on where they are most exposed. That requires a structured, top-down portfolio view—not just of credit and market exposures, but of operational and third-party dependencies that could be vulnerable to geopolitical shifts. Risk measurement and quantification have also made progress, where top-down portfolio analysis is typically the starting point to prioritize efforts across the existing risk types. When starting with the analysis, the selection of portfolio scope is the first determinant. Peers are typically starting with the lending, securities and deposits portfolio on group level. When defining the scenarios for the portfolio assessment institutions employ a small set of intuitive, high-level geopolitical risk scenarios such as increasing trade and investment restrictions. The portfolio segmentation is analyzed for vulnerability to 1st and selected 2nd order effects (especially energy / commodity prices and supply chain disruptions). For the top-down portfolio assessment, most institutions conduct a qualitative impact assessment, clearly identifying relevant risk drivers for the respective primary risk types. Multi-format crisis simulation Once sensitive exposure areas are identified, banks can run simulations to assess how geopolitical events would affect their operations, risk profile, and strategic posture. This is no longer a theoretical exercise. Take the energy-related grid shutdown in Spain, Portugal and France earlier this year. While the root causes were not directly geopolitical, the systemic impact mirrored what could happen in a true geopolitical escalation—forcing multiple banks to activate contingency procedures, reroute processing, and adjust liquidity buffers in real-time. Crisis simulations with geopolitical triggers serve three key purposes: They test multi-dimensional resilience—from financial metrics (capital, liquidity) to operational continuity and reputational response; They sharpen cross-functional preparedness: involving risk, IT, legal, communications, and business continuity teams in a coordinated stress response; and They surface second- and third-order effects—such as delays in reporting due to system outages, failure of key vendors in conflict regions, or jurisdictional clashes over regulatory compliance Depending on the institution’s maturity and exposure, a range of simulation formats is currently being used, from tabletop exercises for initial risk awareness and coordination, through war-gaming scenarios that simulate adversarial moves across regulatory or geopolitical dimensions, all the way to full-scale crisis simulations, including real-time decision-making, interdepartmental coordination, and post-mortem analysis. We are experiencing a new wave of tariff announcements and conflict in the Middle East. While short-term uncertainty may dominate headlines, leading institutions treat it as a catalyst for deliberate, long-term positioning. Key structural shifts—around global alignment, digital sovereignty, and economic fragmentation—require active engagement and banks are using this phase to start building lasting resilience through governance, scenario design, and strategic alignment.

Credit risk modelling: Driving Efficiency with AI Using AI to build credit risk models is no longer fantasy – we have used an AI agent to build IRB models utilising our Hercules toolkit Today’s most complex credit risk models come with substantial costs. Equally, their protracted development phases lead to extended time-to-market. [image: 1762429281554-23ff8182-65f1-4e4b-a129-1ae544091fe8-image.png] Hercules is Oliver Wyman’s agentic AI solution for credit risk modelling, built upon our proven modelling codebase, methodology, and templates, featuring a no-code, natural language interface for steering and oversight by human modellers The agentic AI orchestrator executes the end-to-end model development, refinement and/or re-calibration process according to the desired configuration It leverages our production-quality Python codebase, which has been deployed successfully across multiple modelling programmes and validated by both Model Risk functions and regulators Hercules produces a near-final modelling package with model documentation, all required regulatory artefacts and production code Its intuitive interface proactively presents results, options and recommendations for human modellers to review, discuss with experts and approve – ensuring effective ‘human-in-the-loop’ oversight [image: 1762429455022-7692acb7-a453-480a-b815-65230f32304d-image.png] Hercules combines our proven methodology and codebase with an agentic AI layer to transform credit risk modelling, and designed to support human decision‑making and free-up cognitive capacity by taking care of the mechanical and analytical grunt work [image: 1762350893130-ea39990e-eeaf-4b16-b141-ea06ffa09c9f-image.png] The Hercules’ Agentic AI layer accelerates credit risk model development via end-to-end orchestration, proactive insights and automated documentation [image: 1762429555785-cd58e700-58dc-4397-869b-8accf0bae305-image.png] Read more here and get in touch to learn more about how we might be able support you in deploying Hercules

CFO functions across institutions (and indeed, across industries) share common pain points (data, regulatory overload, change fatigue, etc.) at a time when they face significant cost challenges – especially as the CFO is expected to lead by example within the organisation How do you choose between the effectiveness and efficiency of the Finance function? We believe this is the wrong question, a false trade-off. The best-in-class Finance functions can achieve greater effectiveness and efficiency in tandem In our latest OW Treasures, we explore how to tackle this challenge and drive the Finance of the Future - we’d love to hear your thoughts [image: 1759315911785-c6888084-1e94-4277-8961-fe7ddb7a07a0-image-resized.png]

Beyond Box-Ticking: Strategic Consequences of the EU’s AML Authority The establishment of the EU Anti-Money Laundering Authority (AMLA) under Regulation (EU) 2024/1620 marks the most significant change in the bloc’s approach to financial crime since the first AML Directives. Tasked with directly supervising high-risk, cross-border financial institutions and coordinating national authorities, AMLA will reshape compliance standards, operational structures, and business models. This article analyses the regulatory framework, timeline, and impacts on banks across the EU from 2024 to 2028. Key implications include higher compliance costs, harmonised supervisory expectations, closer scrutiny of crypto-asset service providers, and opportunities for early movers to leverage compliance excellence as a competitive advantage Why the AMLA was created Europe’s AML/CFT regime has long suffered from fragmented national implementation of directives, uneven supervision, and weak enforcement. Scandals involving large banks highlighted gaps in cross-border coordination and beneficial ownership transparency. To align with FATF expectations and restore confidence in the single market, the Commission’s 2021 AML package introduced a Single Rulebook (Regulation (EU) 2024/1624), a new Directive (AMLD6), and AMLA as a central authority Legal Framework: AMLA’s statutory powers, supervisory scope, and enforcement tools Core Legal Basis Regulation (EU) 2024/1620 establishes AMLA, conferring on it powers to directly supervise “selected obliged entities” in the financial sector, coordinate and oversee AML/CFT supervision across Member States, support and coordinate Financial Intelligence Units (FIUs), issue guidelines, regulatory technical standards, recommendations, and enforce its own decisions in certain cases The AML Package includes the AML Regulation (EU) 2024/1624 (providing a Single Rulebook), AML Directive (EU) 2024/1640 (AMLD6), and other instruments (e.g. for transfers of funds / crypto transfers). These combine to broaden obligations and reduce national discretion Supervisory Scope AMLA will have two main supervisory modalities Direct supervision of selected obliged entities, which are financial sector entities (credit institutions, investment firms, insurance undertakings, crypto-asset service providers, etc.), satisfying criteria of: Operations in at least six EU Member States (by branch or via freedom to provide services) A high ML/TF risk profile as assessed by AMLA (“inherent” and “residual” risk) First selection expected to cover around 40 entities/groups, with selection every 3 years Indirect supervision / Coordination / Convergence: For all other obliged entities, supervision remains with national authorities, but AMLA will set binding technical standards (via Regulation), issue guidelines and recommendations, conduct annual or periodic reviews of supervisory authorities’ performance, coordinate peer reviews, facilitate cooperation among FIUs, resolving supervisory disagreements cross-border, etc. Enforcement Tools For selected obliged entities, AMLA will have administrative measures including orders for corrective measures, temporary bans on persons, etc. Ability to impose pecuniary sanctions for serious, repeated or systematic breaches of the AML Regulation, including periodic penalty payments to ensure compliance Transparency: public naming of decisions in certain cases. National authorities for non-selected entities will be expected to follow AMLA guidelines. AMLA may issue warnings if a Member State fails to correctly apply EU rules Other Powers Monitoring and assessing ML/TF risks in the EU internal market and wider world; gathering data; establishing a central information database accessible to national and EU supervisors Overseeing FIUs: facilitating joint analyses of suspicious cross-border transactions, improving secure information exchange (FIU.net), training, technical / IT support [image: 1759221598016-amla-1-resized.png] Transitional arrangements will include grace periods for some obligations, phasing of enforcement powers, and continuing national supervision (with cooperation) until direct supervision kicks in. Entities selected will likely receive notice ahead of time and have reasonable notice to adjust. Some technical standards / guidelines will apply from earlier dates or upon issuance Operational Impacts for Banks Banks and other obliged entities will need to adjust multiple aspects of their compliance operations. Key areas where operational impacts are likely (2024-2028): Customer Due Diligence (CDD) Stricter beneficial ownership requirements under AMLD6 Enhanced due diligence for politically exposed persons (PEPs), high-risk jurisdictions, cross-border/onboarding of clients in other Member States. The risk-based approach will be standardised across the EU, reducing margin for national variation More detailed ongoing monitoring obligations, review of residual risk, more frequent updates to CDD records Transaction Monitoring and Suspicious Transaction Reports (STRs) Given AMLA’s mandate over joint analyses (FIU cooperation) and monitoring, banks will need to ensure transaction monitoring systems are capable of producing information that supports cross-border patterns, large and complex transactions, crypto flows, etc. STR submission standards may become more unified; expectations for timeliness, quality, and use of analytics will increase Sanctions Screening Integration of sanctions compliance with AML/CFT obligations will become even more crucial, particularly since AMLA’s powers include ensuring selected obliged entities have appropriate internal policies for targeted financial sanctions, asset freezes etc. Increased overlap among AML, CFT, sanctions regimes (national, EU, international) will require more centralised functions in many banks Crypto-Asset Service Providers (CASPs) Oversight CASPs are expressly included as possible “selected obliged entities.” They will be subject to direct supervision if they meet cross-border / risk criteria Even for non-selected CASPs, the indirect supervision and technical standards will raise the floor, requiring improved controls, transaction traceability, monitoring of crypto-asset transfers Data and IT AMLA will maintain a central information database; banks will need to ensure data compatibility, submission of required data, quality, timeliness Upgrading or enhancing transaction monitoring systems, STR analytics, AI/ML tools; cross-border data flow infrastructure; strong model governance Onboarding/ Offboarding Uniform rules will reduce some of the friction caused by national differences, but the cost of adjusting onboarding policies, risk classification, escalation procedures, enhanced due diligence will be non-trivial. Offboarding (client exit) decisions may be more scrutinised in cross-border / high risk settings [image: 1759221884524-amla-2-resized.png] Drivers of cost System and data architecture upgrades (including analytics, AI/ML, cross-border data flows) Hiring or reallocating compliance, legal, risk personnel; possibly setting up dedicated “AMLA preparation/ liaison” functions Training and change management across country teams and business lines Remediation of past weaknesses: e.g. beneficial ownership, lack of consistent policies, documentation gaps External advisory, audit / validation cost Savings / possible offsets Over time, standardisation may reduce duplicated effort across national jurisdictions Shared services (e.g. central transaction monitoring, vendor-provided screening) may achieve economies of scale Improved automation, better analytics reducing false positives or inefficiencies Strategic Business Model Implications Cross-Border Operations and Correspondent Banking Banks with large cross-border footprints will be under direct AMLA supervision; this increases risk (regulatory, compliance, reputational) but also relative advantage for those who perform well Correspondent banking relationships may be scrutinised more closely; some banks may “de-risk” by terminating or reducing exposure to jurisdictions or partners with weak AML/CFT track records. This would reduce correspondent banking network densities Crypto Services Firms engaged in crypto-asset services are part of the scope; those with cross-border operations and high risk are likely to be directly supervised. Crypto service providers and the financial institutions that interface with them will need to close gaps in transfer traceability, origin/destination controls, screening, etc. Client Onboarding/ Offboarding Stricter uniform CDD and enhanced due diligence will likely slow onboarding for high risk / cross-border / crypto clients Banks may re-evaluate acceptance criteria. Offboarding decisions may become riskier, especially in jurisdictions or with clients triggering systemic risk Reputation, Risk Appetite and Business Lines Reputational risk will amplify failures in AMLA’s directly supervised entities will likely draw EU-level attention and public naming; non-selected entities, while under national supervision, will still face scrutiny via AMLA’s reports, peer reviews, etc. Banks may adjust risk appetite: reduce exposures in high-risk jurisdictions; shift business lines less exposed to ML/TF risks Competitive Opportunity Those banks that prepare early and demonstrate strong AML/CFT frameworks may benefit lower cost of compliance in the medium term Ability to serve high risk clients more credibly; help with cross-border business; possible regulatory “trust premium.” Governance and Organisational Change Risk appetite & oversight: Boards and senior management must engage more directly; AML/CFT must be elevated in enterprise risk frameworks, with clearer metrics, KPIs Lines of defence: First, second, third lines will need clearer roles: compliance units, internal audit, legal will need to coordinate; possibly new roles for liaison with AMLA; stronger independence Incident response: Prepare for more inspections / audits; better readiness for regulatory investigations; crisis communications (reuse of reputational risk) Shared services: Many banks will centralise compliance functions to avoid duplication across regions; consider internal centres for excellence Technology and Data Requirements Standardisation: Uniform data definitions, standardised risk scoring, harmonised reporting templates across EU; data models that meet AMLA’s technical standards Analytics / machine learning tools: To detect cross-border suspicious patterns, large transaction volumes, crypto flows, link networks of entities FIU integration and secure data exchange: Banks must ensure that systems can interoperate with FIU requirements, central database; privacy and security; resilience Model governance: More robust validation of AML/CTF models; oversight of AI/ML components; assurance of explainability particularly under enforcement. Operational infrastructure: Real-time or near-real time screening (transaction, sanction, PEP etc.), scalable data storage, audit trails [image: 1759225380772-amla-3-resized.png] Recommendations: Strategic Priorities for Banks To manage the transition and exploit opportunities, banks should consider the following strategic priorities: Short-Term (2024-2026) Gap analysis / readiness audit: assess current AML/CFT frameworks against AML Regulation / AMLD6 / AMLA draft technical standards; especially for cross-border operations, CDD, sanctions, crypto Stakeholder mapping and liaison: identify whether bank is likely to become a selected obliged entity; engage with national regulators; monitor AMLA’s upcoming guidelines / selection criteria Data and systems inventory: map data flows, reporting, IT systems; identify gaps for traceability, cross-border transaction monitoring Resourcing plan: estimate additional staff, budget, and external support needed; hire or train early; plan for centralization or shared services where possible Policy standardisation across jurisdictions: harmonise internal policies, risk classification, onboarding/offboarding, PEP/ sanctions screening to reduce divergence Medium-Term (2026-2028) Implement technical tools: deploy or upgrade transaction monitoring, AI/ML, analytics for cross-border suspicious patterns; build pipelines for large data sets; enhance model governance Compliance culture and training: firm-wide training; embed AML/CFT in business line planning; set measurable KPIs; align incentives Scenario planning and stress testing: simulate supervisory inspections, enforcement; test readiness for adverse events (e.g. failed STRs, sanctions breaches) Strategic portfolio review: re-evaluate correspondent banking relationships; exposure to high risk jurisdictions; consider withdrawing or offboarding where risk excessive or cost outweighs benefit Collaboration and industry engagement: engage with peers, trade associations, FIUs; monitor AMLA / EU-level regulatory discussions; possibly influence upcoming technical standards Long-Term (2028 and beyond) Embed continuous improvement: establish a cycle of review, benchmarking against best practices, adapting to evolving ML/TF threats (crypto, AI/tech-enabled crime) Leverage harmonisation for competitive advantage: streamline cross-border services; reduce internal friction; offer clients more consistent experiences across Member States Invest in resilient infrastructure: ensure data privacy / cybersecurity; robust disaster recovery; compliance with technological and regulatory evolution (e.g. blockchain, cross-border payments) [image: 1759227604985-amla-4-resized.png] AMLA introduces a new, more centralised, harmonised and enforceable regime for AML/CFT in the EU. For banks, especially those with cross-border profiles, the period 2024-2028 will be one of substantial operational, strategic and financial change. The chief challenges are in upgrading data, systems and processes; managing cost; aligning risk appetite; and preparing for stronger enforcement. But banks that act early—auditing their current state, investing in technology and governance, and shaping their policies to meet the new rulebook—can not only avoid penalties, but gain competitive advantage in a higher transparency, lower arbitrage regime. Leadership should treat AMLA not simply as a compliance burden but as a strategic inflection point: one that may reshape business models, product offerings, and cross-border strategy for years to come

@OP In my experience, it typically depends on the bank's approach to the override: Pre-calibration would typically be included if they are trying to include is as an statistical predictor of risk: i.e. you have some historical information that help you calibrate the specific weight and you only include the override if it increases the predictive ability of the model Post-calibration if they want it to be a “penalization” mechanism for management (however this will not be fully compliant with EBA calibration guidelines for the use of overrides in IRB models)

In the context of the 2025 EBA Stress Testing exercise we’ve convened our sixth EBA Stress Test industry roundtable, involving representatives from 25 of the largest European banking institutions across ten countries. While each bank is looking to approach the stress testing exercise from its own unique perspective, we’ve found that two common trends seemed to emerge: Banks expect the anticipated depletion of the Common Equity Tier 1 (CET1) ratio under adverse scenarios to align closely with the outcomes seen in 2023. Banks see the operational complexity of the exercise as their main challenge. Participants were concerned about potential CRR3 re-statements (particularly the difficulty in accurately projecting a CRR3 Fully Loaded framework that incorporates all CRR3 phase-ins expected by 2032) as well as the need for top-down calculations to estimate CRR3 compliant RWAs, which could complicate reconciliation efforts and impact result accuracy. Other concerns raised by participants included the new timeline and significant changes to Quality Assurance processes - especially regarding potential on-site visits and inspections by the European Central Bank (ECB) - and the unpredictability of the new Net Interest Income (NII) platform and Quality Assurance machinery, which banks believe leaves them with less control over projections and adds to the uncertainty of the exercise. Overall, it was insightful to see how given the inherent complexity of the exercise participants agreed on the need for thorough upfront preparation and a robust end-to-end stress testing infrastructure as conditions to success. What are the main concerns at your organisation? How do you feel your competitors will react to EBA’s requirements for this year’s stress testing? Graphics: How Oliver Wyman supports Financial Institutions carry out stress testing: [image: 1742826199933-cc0303ff-d517-49f9-b22c-e6d2071f1964-image.png]

[image: 1760030643277-picutre.jpg.png] On 9th October 2025 we held our latest RiskBowl Live roundtable with participants from 10 banks and building societies, alongside two of our senior advisors: Colin Jennings (ex-PRA and ex-CRO) and Lukasz Szpruch (The Alan Turing Institute). This roundtable brought together senior heads of Model Risk Management to take stock of where banks are on managing the model risk of AI and discuss their convergence towards full compliance with SS1/23. The discussion confirmed a common trajectory: an early phase of AI modelling experimentation has exposed structural gaps — in taxonomy, inventory management, model monitoring and validation — that now require a coordinated effort to make bank-wide AI use safe, auditable and scalable across firms. Firms have welcomed the clarity and the heightened stature of Model Risk in the firm’s risk taxonomy, and are using its guiding principles to coordinate said effort. Key takeaways from the discussion are presented below: Managing the model risk of AI • Experimentation to consolidation: participants described an early period of numerous disjointed pilots and recommend grouping similar use cases to scale efficiently rather than proliferate ad hoc AI projects • Use case specific governance: high risk algorithmic/decisioning use cases require materially different controls from low risk productivity tools; a one size governance model is insufficient • New tech stack & MRM implications: generative AI brings dependencies that must be formally approved and governed. These create integration and approval work that traditional MRM processes were not designed to cover. • Skills and vendor risk gaps: many teams or vendors originate outside banking and lack knowledge of bank’s processes, compliance expectations, and model lifecycle controls; stronger third party standards and onboarding are needed • Model classification ambiguity: simple assistive tools (e.g., grammar correction) may fall outside current model definitions, while some AI systems sit partially within model risk remit—creating uncertainty about monitoring and ownership • Committee and oversight design: avoid duplication of oversight bodies — firms must clarify roles between existing model risk committees and any AI monitoring forums • Quantitative monitoring and human AI controls: firms want monitoring frameworks capturing model and human performance, with defined escalation triggers and the ability to switch to automated testing based on scale and level of risk Convergence towards compliance with SS1/23 • Raised standards and visibility: SS1/23 has driven broader Model Risk visibility within firms and heightened board awareness • Material operational uplift: documenting and managing additional models and DQMs in scope is increasing resourcing and cost materially — firms reported significant headcount increase and process redevelopment • Definition and scope tensions: debate continues on what counts as a model (quantitative, deterministic, qualitative outputs, agentic behaviours) and on incentives to classify or de classify to manage control and operational burden • Validation and ownership challenges: validating qualitative and AI enabled outputs is resource intensive; teams need clarity on who conducts testing (first line, MRM, or specialist validation units) and on practical monitoring cadences • Ongoing dialogue required: participants agreed continued cross firm engagement and proactive regulatory conversations are necessary to align interpretations and reduce operational fragmentation between firms and subsidiaries Cem Dedeaga Partner, Head of Risk Modelling UK&I cem.dedeaga@oliverwyman.com Matias Coggiola Senior Manager, MRM lead matias.coggiola@oliverwyman.com Download the above as PDF by clicking on the link here: 20251009_MRM_Roundtable_Summary_vF.pdf

Hi RisbOWl community. I have been thinking lately about the dynamics of the working relationship with 2nd and 3 LOD from a 1LoD perspective. While there is much talk about these dynamics from a high-level, ERM or governance perspective, those of us who are in involved more on the day to day interactions need to make sure we 'walk the talk'. While clear, continued communication is key, I have found the use of shared resources (such as evidence repositories, plans, collaborative query logs, etc) have really made a difference in the relationship we have built with our validators in the second line of defence. What does the community think about common techniques for increasing cross-line of defence productivity. Thank you in advance.

Lights, Camera, Compliance! Imagine you’re in a high-stakes thriller, much like Inception. Just as Cobb and his team navigate complex dream layers, banks and financial institutions today are navigating the intricate layers of BCBS 239. But instead of dreams, they’re dealing with data and the regulation that aims to enhance risk data aggregation and reporting capabilities. What is BCBS 239? At its core, BCBS 239, introduced by the Basel Committee on Banking Supervision, is a set of principles designed to ensure that banks can effectively manage risk through accurate and timely data reporting. Think of it as the ultimate guide for navigating the labyrinth of financial data, ensuring that institutions can make informed decisions and respond swiftly to crises. The Challenges: A Real-Life Drama However, just like in a good movie, the path to compliance is fraught with challenges. Here are a few key hurdles that institutions face: Data Silos: Many banks operate with fragmented data systems, akin to a band struggling to harmonize. Each department has its own version of the truth, making it difficult to achieve a cohesive view of risk exposure Legacy Systems: Picture a classic car that’s seen better days. Many institutions rely on outdated technology that hampers their ability to aggregate and report data efficiently, making compliance feel like an uphill battle Cultural Resistance: Change is hard, much like a character in a romantic comedy who refuses to acknowledge their feelings. Employees may resist new processes and technologies, fearing disruption to their routine Regulatory Complexity: The regulatory landscape is constantly evolving, much like the plot twists in a suspense thriller. Keeping up with these changes requires agility and foresight, which can be a daunting task for many organizations. The Road Ahead So, how can institutions turn this potential drama into a success story? Here are a few actionable steps Invest in Technology: Embrace modern data management solutions that break down silos and streamline reporting processes. Foster a Culture of Compliance: Engage employees at all levels, emphasizing the importance of accurate data for decision-making and risk management. Stay Agile: Regularly review and adapt to regulatory changes, ensuring that your compliance strategies remain robust and effective. While BCBS 239 presents its challenges, it also offers an opportunity for banks to enhance their risk management frameworks. By embracing the journey with the right tools and mindset, institutions can transform compliance from a burden into a strategic advantage. Let’s continue this conversation! What challenges have you faced in navigating BCBS 239? How have you overcome them? Share your thoughts below!